Mitsubishi Electric software suffers from a weak password‑recovery mechanism that allows an attacker to obtain a static challenge response used by all users. By leveraging that response the attacker can unlock the system remotely, gaining the ability to read, modify, delete internal data or trigger a denial‑of‑service. The flaw is therefore a critical credential bypass that enables full system compromise.

Vulnerable products include Mitsubishi Electric’s AnalytiX, BizViz, GENESIS, GENESIS32, GENESIS64, Hyper Historian, ICONICS Suite, IoTWorX, MC Works64, and MobileHMI, as well as the corresponding Iconics Digital Solutions versions. For GENESIS the affected releases are 11.03 and prior; GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and IoTWorX are vulnerable in version 10.97.3 and earlier. All versions of MC Works64, GENESIS32, and BizViz are affected, and the same version ranges apply to the Iconics Digital Solutions editions.

The CVSS score of 9.2 places the flaw in the critical range. While the EPSS score is low (<1%), implying limited known exploitation, the feature is remotely exploitable, and the flaw could be leveraged once the challenge response is compromised. The vulnerability is not listed in the CISA KEV catalog, but its high severity and potential impact make it a priority for remediation.